Vulnerabilities (CVE)

Filtered by vendor Nodejs Subscribe
Filtered by product Node.js
Total 71 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2016-6304 3 Nodejs, Novell, Openssl 3 Node.js, Suse Linux Enterprise Module For Web Scripting, Openssl 2021-11-17 7.8 HIGH 7.5 HIGH
Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.
CVE-2016-6306 4 Hp, Nodejs, Novell and 1 more 7 Icewall Federation Agent, Icewall Mcrp, Icewall Sso and 4 more 2021-11-17 4.3 MEDIUM 5.9 MEDIUM
The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c.
CVE-2021-22930 1 Nodejs 1 Node.js 2021-11-12 7.5 HIGH 9.8 CRITICAL
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
CVE-2021-22931 1 Nodejs 1 Node.js 2021-10-22 7.5 HIGH 9.8 CRITICAL
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
CVE-2021-22884 4 Fedoraproject, Netapp, Nodejs and 1 more 5 Fedora, E-series Performance Analyzer, Node.js and 2 more 2021-10-20 5.1 MEDIUM 7.5 HIGH
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.
CVE-2021-22940 1 Nodejs 1 Node.js 2021-10-20 5.0 MEDIUM 7.5 HIGH
Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
CVE-2021-22883 4 Fedoraproject, Netapp, Nodejs and 1 more 5 Fedora, E-series Performance Analyzer, Node.js and 2 more 2021-10-20 7.8 HIGH 7.5 HIGH
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.
CVE-2021-22939 1 Nodejs 1 Node.js 2021-10-20 5.0 MEDIUM 5.3 MEDIUM
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.
CVE-2020-8277 4 C-ares Project, Fedoraproject, Nodejs and 1 more 4 C-ares, Fedora, Node.js and 1 more 2021-10-20 5.0 MEDIUM 7.5 HIGH
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.
CVE-2018-1000168 2 Nghttp2, Nodejs 2 Nghttp2, Node.js 2021-10-17 5.0 MEDIUM 7.5 HIGH
nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service. This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in >= 1.31.1.
CVE-2020-8174 3 Netapp, Nodejs, Oracle 8 Active Iq Unified Manager, Oncommand Insight, Oncommand Workflow Automation and 5 more 2021-10-07 9.3 HIGH 8.1 HIGH
napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.
CVE-2021-22918 1 Nodejs 1 Node.js 2021-09-20 5.0 MEDIUM 5.3 MEDIUM
Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().
CVE-2021-22921 2 Microsoft, Nodejs 2 Windows, Node.js 2021-09-20 4.4 MEDIUM 7.8 HIGH
Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking.
CVE-2019-15606 5 Debian, Nodejs, Opensuse and 2 more 6 Debian Linux, Node.js, Leap and 3 more 2021-07-20 7.5 HIGH 9.8 CRITICAL
Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons
CVE-2019-15604 1 Nodejs 1 Node.js 2021-07-20 5.0 MEDIUM 7.5 HIGH
Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate
CVE-2020-8172 1 Nodejs 1 Node.js 2021-07-20 5.8 MEDIUM 7.4 HIGH
TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.
CVE-2018-7160 1 Nodejs 1 Node.js 2021-07-20 6.8 MEDIUM 8.8 HIGH
The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.
CVE-2019-15605 1 Nodejs 1 Node.js 2021-07-20 7.5 HIGH 9.8 CRITICAL
HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
CVE-2016-3956 3 Ibm, Nodejs, Npmjs 3 Sdk, Node.js, Npm 2021-06-15 5.0 MEDIUM 7.5 HIGH
The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive information by reading Authorization headers.
CVE-2020-8287 4 Debian, Fedoraproject, Nodejs and 1 more 4 Debian Linux, Fedora, Node.js and 1 more 2021-02-19 6.4 MEDIUM 6.5 MEDIUM
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.